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Abstract of JP2001345819 

PROBLEM TO BE SOLVED: To provide an 
access point device and a method of 
authentication processing therefor, with which a 
security level can be remarkably improved, in a 
wireless LAN system. SOLUTION: An access 
point device 18 is provided with an authentication 
request display means 16 for making the access 
point device 18 report the existence of a mobile 
station requesting authentication for obtaining the 
final permission of an authentication procedure 
inside an area, to a network manager for 
managing a LAN, when the mobile station inside 
the area is to perform the authentication 
procedure, before the start of an association 
procedure and an authentication input means 15 
for the network manager, who receives the 
notice, to instruct the permission of refusal of 
authentication to the mobile station requesting 
authentication. 
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■f-SlWtfSBE^JRSrtTJapt-fSW^fc, tu IE LAN?: 
BSE £ * *T v> 5 &9hm\ztt L T ©BSEWlfnTX fiJIS 

flMEBSE¥«n:J:!K tftsar^-t^jK-f ^HStfiis, III 

WIB»tt«^igflrr«Wki, tufELAN^^S-r^-^s/ 

£: £ t>t-. S^BSiE^fcixSSTCD**:^ 
*> ^ S:^^ L fc»BB» *> * v £r X 9 — V $ * 3 $g 2 

*WB*y h!7 MfET^-te^tf-f^MSB 

t , WfET ^ -fe^ jK-Y >- N ^Bri s , flJlEISEE^^^ y ir 

ZMff-fZ - 1 K «t 0 BtilE^i!j^<£>B!iEri s 5£7 U 7V 

[»*« 3 ] ittrlEJg 3^fy T'-Crt, HtffE4 y V V - 

BSEJiSi: UT«rSa*»JBfcjg«i-5r. 
lf**2lE«<OT^-fe:^^-r >- h^Bcofgfl^a^fe 
[11**4] fflK83*yy^H\ *frfE*y r-P- 



J»TV birz t. HufBBSBS^;* yfe— v 5 *, BSE 

* 2 lE^tO T * ir * /tf-f" >- h ySB©BliEMa*?£„ 

[ft** 5] t&IBBIE¥tttt* IEEE8 0 2. 1 1 
/4 5 S>3£1"2> Shared Key Authentication#JlR-efc3 d £ 
4r#mti- ; 5lt*^27iM4<D^-f e tl/jWC|E«©T^-fe 

[^PJOp/HB/£tftB^] 
10 [00 0 1] 

fflbfc, !7>firl'*LANv';*7 i .MCi3l/>T, JSESrtt 
o 1tm A%-<D&W)mfa b (D^sEti T 9 ir ^ Sr B5lh-T 5 fc 
ft©7^t^^yh SB^t^^ ©BBEtea^tSfeJ-Hi- 
5. 

[00 0 2] 

t7-f7 4 ^fi^T% LAN (Local Area Netwo 

20 rk) *ffi%k~tz>>r— ^.^Jtx.-c#rv>5o 7 s *S$>\>W$k 
b> M^TLANSr^H-rS, l*^57Yt^LA 

^©#^-&m* 5 »#^^t:^-5o dcD^-rir^^LAN 
©^W^ftf i Utli, ffiC, IEEE (Institute 
of Electrical andElectronics Engineers) (dtaVT^ 
«!Wb$^TV^5, IEEE8 0 2. lliSfeS. d<0 

30 SWk^^fcSWfiv os i ^y=VHcjott?), #ias^ 

-r — ^ !I > / ^OT{4I l JS"Cfc ; 5MAC (Media Acce 
ss Control : fflfc#T*-fc;*#J8P) **T?Sra£L.T*S 
(9, liSOLANfiiHt'fc^i, ^-f-^yhtl* 

JP^ffii LT, o-^^ (roaming) m&bfe&T'Z 

[0 0 0 3] tH^-t-^J/m, LAN 

Sr«^-T5^a-, LAN^SHK-f-Sr. tfi, ^a«3»C, 

40 (D-fedr^. y -r -f u-<j^it0m^M^\ o4(3, 

l-S^LJ: Ulott, >5r-7 f /^^ < ^:^^5!fea^^ 

ftLANOBUfcS (4*^, tt»W'f/ha«OLAN) 

^©LAN^t5^^-^-?« ! > 

so — ~>gV (Association) #>R(^ <t 9 5<, HM 
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3 

IE, WtffCO I EEE 8 0 2. 1 l^^fAC^P 

^fyf (access point) 0>#/<— t*S**P5^ !/ TKlV^S 

[0 0 0 4] Z.<F>TV i/3i— v-a V^JffiUlJzfttf, tulS 

-fc— SS I D (Service Set Indentifier) $r 
^3;^, ^JxfcSWUfcT****^!^ WES S 

31— i/ 3 vf^/v— ^^7yvx-i/ 3 y5: 
fFRli-5i»if 5 ff^ri"S»^f4. 7yi/x 
-v/g >fP*T<£>^{gy ;yi?-v>£r, *E5-*-5»frtt, T 
yi/x-v^a ^ffi^Oigft y y-fc— S?S\ itna»ft«fc 

is, iOSS IDSiAf UtUSitf, «»C7y-> 
3i—$/g VjJSprtBfcfco-CLS 5o -tttSriB^-C, *T 

[0005] IEEE80 2. 1 1 fcl*51/ vffcj^ 

tt\ Shared Key Authentication^! £ Itg 
«S*bT*59, ^©#0«:H5atJ«H6k:jL!JlllW-r 

jatsH-BL H6H, a*©«BE#)BiTy^— >s 
[o o o 6] Ei5^jov^-c, i fip-r -ru* - 3i y r ■ 

MT 1 , 4fcM£tWgMT2, 5tt»lWaMT3, 6 ttS 
Kj^MT4, 7H!7^t^-xy7-^^hy-^l 

[0 0 0 7] fc5^r«ea68SfcJ:5lia*ix5, 
h!7-* 7Kltttt*ixfcT^-fe^*'f ^ HAP 2 £, -t 
W7^t77K-fyhAP2^/<-t5, ^w^yr 
SUflMTU MT2, MT3, MT4^ 

^x, hz>®mm mz-i£* mtd # % massr&A-r 



[00 0 8] ^Eb^MT 1 Shared Key Authe 

ntication*ifefcJ:5»E*«*fcM*&i-5fc«)<0, IS 
fES#y y-fc— i?i Sr, 7^t7^ybAP2t:lfl 
i"5o APBBB&J18 (APBBEtoS r l j ) £ IT, 
rcoy ^ir-i/§:S:fSL.^AP 2lt rcoBSE#$c#<£> 

ffiStft»5-tA5"Cf 5, Initialization Vec 
io tori Secret KeyCOiBSr. WE P (Wir 

ed Equivalent Privacy) PRNG (Pseudorandom Numb 
er Generator) (DT^^ V X-Mdftl ^ft<t*JS*rfft\ 
1 2 8 0 ctet^ — iclCjfc^ ^Challenge TextCDfit 

K^MT i icism-r^o 

[0 0 0 9] Wc, MTIE&19 (APBSB&3 
T2j ) tit, ^BmEiS^y ^/ir-^l SrSffbfcS 
EWSMT 1 ft, ^rCO^-g-^tlSmrlEChallenge Text<Dfi6 
WE PCOPf^kT/W^y X-M£?£V\ Shared Secre 
20 t Datai, Initialization Vector §r s<*7 y fc, Bf 
^tSrff V\ ^CDife^^ ffjfEInitialization Vector £ 

g|Eg*ys/t-v J 2(:^fet, mjfST^ir^/Jf 

[0 0 10] APifEMllO (APlSiiE^a 

T2j ) tlt> *»SE»*7« y-fe— ^2*rS«Ufc, 

lenge TextCOfB^r, I^WKSfi Ufc Initial izat ion Vec 
tor<b N ^i6^qoTt^mjfSShared Secret Data£2£tC 
r^-KU ^CO^St, mJ^O^CDChal lenge Text<£> 

30 fi£SrJt«L, -tixdSRI— -efcttff, BBEffsrt U HI— 

-^2i L"C> WMT l *B 
IBS^^ y-fe— ^2 SrS«Lfc»»JBMT 1 tt, -^co^ 

[ooii] ::wy^-v3y»ift 
at), 7yvx->3yg*y<y 

i/4i(7), SS ID (Service Set Identifier) SrS 
40 ff LfcT^ir^TK-r y hAP 2*5, tulSS S I DtCT, 

/V— Mz&\,\ Wyvx-i/g vSrffnli-S^if 5 

^stsu, ff^ii-5*&tt, ry 1/31- v/ 3 >^prto 

7*y i/3i— i/g ^JggcOTy i/3i— i/g v^^y -yt— 
y XAfi, RSA Data Security Inc. COR C 4 

[0012] 0419, r^EEE^jfe^ittrJ, r^-fe^ 
so 7jf^^/ ht^Ki^^, fc^i:^, 8Me<z>K e y-CfcSSh 
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ared Secret Key 5 - t X\ T i? ir * V h 

ttia^SrHmLTI/^o r^T% ^ft^lijfi, ^Shared 
Secret Key£r, — ir'^b, St^ftfbft 

WIT. *Ke y &#&mm&vk&*ft$&5^ktffo^ 
[0 0 13] 

Key^ JB*8r**oT-*y — ^t-ftAUi 5 it 
a y -r -f ©tfUfc-cfc t) , r ^>BtiStt ioo %tlifcT-£ 5. 
-fVhK:. BfE"5Tfgft3ffi*<£>£< tf— f^b^i 
S4^**yfc, t&ftiHTV^Key^ ( <ftft&%£ 

^rtftO^-^/wSSR© J: 5 4#»3att<etPIH4 Lfc, 7^ 
feSWDtjtbfcSra ME) rt-e, !7-fir 

^t^*^y h rs^y TF^-efctttf, f©K 

[0 0 1 4] #3§9!f3\ r©±5fc«IWfc«*-c4£*t 

So 

[0 0 15] 

^^-7^-^aie^r«^x i^LANxy7rt-eit 

HtitBLANSr^Si-S^s/ h!7-**a#K:#U BSE 



6 

[0016] **io7^t^jK>fy HKBastEtea 

-?-7*-xmm*m?L. iiLANxD7rtx-it© 

©BSE*aa*fetc:*5i/'>T, BulB^tft^d^BulBT^-fe^ 

7^t^^yhiiA5, ^oiafg^riMsf 

Ufy7"i, WIEBIE#^J;!3, *WB7 * ir* #W 

«rfEBBE#ttJc:ti»t5*<*^ yir-v ! -r-;fc3BfiD& 
tf* yfe-v>Srl!WE»tb^^ig«-t-6WH:, ffflEL AN 
Srtfa-fS^y M7-^«S*icMLT, ftifSBtiE^MS 

5 * *>B*M L fcBEE^F *> * -< ^ £ * * 

KraBT^-fe^^VH^ltJCJtLT. mJSBEE#*> 
J*TV M"5fl&f-x *^K)BfEcoffsrxfi 

fc. ft*IWB!iEff^ifi^$^5i:, BufBT^-fe^-f 
y^gtii 5 , HtrlBBIE^^^ s/-fe— v'Sr, BtEfF^It b 
T ttt8BI»tb A Jim-f- 5^4^7 7^, HtrfSBfEJES:^ 
^ y ir - v 5 5r^« L fcttrffi^K)^^ , r y v- 3 ^ 

9 $iffi&W}m(D%&mtffc.T U 7V ->^— ~> a >-#Jil$r 

[0 0 17] *fc, mrlE^3^xs'y-x?Ji, &m*-y h 
BfESr*gS : -t--5tt^Sr*frlST ; J'-fe^JK 
30 ^>-h»1HCjg^Ufc*e-^ SWEBtiE#aEKl*i»t5* 

[0018] BtFlE^ 3^fy y-Cfi, HtflB-^ -y h 

UvAtttt&ttfKj: bXfi, BtffiBIE^fi, IEEE 
40 8 0 2. 1 1 i4 5 ^i^i~ 5 Shared Key Authentication^ 

[0019] 

fe©HJ£<ZJ^«8ico^Ti¥iNB^|jiPJ-f-5o 111 If*. *IS 

[0 0 2 0] *Ilffl»77t7^yhitl 8 
(i, mn&E\ 5 <OT?± NAP 2lcfitiitK 

so a$tt5 0 h1tiebi5»c*sv^-c, *>5*nt*ei£ 
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T?-&X7$j> hAP 2 ^rCDAP 2tf%/<— 1"S. 

^"Pg/i^y TlzfF&i-Z&mmMT 1 , MT2, MT 
3, MT4A»bi^$H5, !7 -f U^. • iU7 • 
\*V-y- Hc&b^X, BUlET^-fe^^W hAP 2f±, 

[0 0 2 1] 01 K*5V>T, X^-fe^/K-fX h§£gl 8 
f±, &W<n&mmMTl, MT2, MT3 S MT 4i© 

Mifti 2t. %ummt&m^&i 2iztgm.ztiz>M 

ww^e^ss 1 7 td i * y > * u . mMmm 
ym^-tki 2tr j; ^sm^sx-^sr-f ^#-7=. 
-*-f-s$titg£3i?i-rs.*-.y 

tB£E#«£3l*TU ^-rx% ^gtc^S. Stb^MT 
1, MT2, MT3, MT 4 £3c&$*bS$lJfipy •;/-&— 

v'Sr^ffim^a^ i 2 b^<o t<oi-^mm^Mmi- 
— g^^w f-^^-eisiis* ltv ^s 

!£ 1 6 (il&^IS:) t » BiIEg#*^#lS: 1 6K£<om 
V* • x!) T • *y 1 §r«1-3^— 

l 3 {iJiftj-f-s fcfetc^i? >>m<nAm<n%)mft 

[0 0 2 2] HT> ±i£»J; olCffitiZZtitcTy-lzxtf 

(±, feS^W)^;^ m^&A^tMl^i 9, fgH^lS 

^yhgf 1 8 icD^'-i? y Vif«M^5t35:$n5# 
t BfE/infES $ fi % ^ n *s— >r *sft?^i- So 
[0 0 2 3] tuffBSO 5 K^tfS^Ki^MT 1 £r, BSE*& 
SSrtf 5*f*»^ib^i L, »1MT2, MT3. M 
T4f4, UElcT^-fe^TK'O' hg«l 8 tTyV^-v- 

9-y-i<gm? S^.- If*, -tCBSE&fr^TU 

7y-^->3 V#gg#tdJ:?), T^i?;*^:/ h 

gfii 8 bof-* » >'?tm±zti?>m&&. m2R 

tfE]4£#P.8LTtft^i-S„ 
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[00 24] m 2 f±. »ErF*r©»£-©BliE#>H©WJ» 
^©IRlfN- J: 9 > £T> Shared Key Authentication^ 

[0 0 2 5] Ti5"fe^.^-Y>- higfil 8(d*JI/>T. SiiSl 

BIE/T y V 3 V*Q.31#I8: 1 3 fi, A PBBE*!iS 
1 (0 2 co#-S§- 2 0#H8) iLt, r(OBIE#gctcoS 
io {C, ftsfC^feSCl ty5 s "C#S. Initialization Vecto 
riSecret KeyCO{jfi$r/-?7 ^ — ^ t L> WE P (WiredEq 
uivalent Privacy) PRNG (Pseudorandom Number Ge 
nerator) 07;U^D XAICfif^f ftH5I?;ftV\ 12 
8 0 c t e too— St-^:*S Challenge Text(0{i£r^tftf 

12^ LT^ft^MT 1 ^i^fB-rSo 
[00 2 6] &lc, MTB!iE^a2 1 t L"C, *BHEiS 
^y y-fe— v=l 5rS«Lfc, #S)^MTl»i, *<Dtp\z 
^^tbS Challenge TextcDfjt^, WE P <Dlfe%\\LT 
20 y XAtdtJ§v'» N Shared Secret Data b Initialization V 
ector£r/N°9 J- —?Xc LTBf-§"fkS:ff l/\ ^r^ffi^Initi 
alization Vectori*}', WMMifr* >y±— v 5 2 
T7^t^Wyhggl 8lriim-rSo Sfet-, 

-fe^Tjf-o hggsi 8fc*jv^x. **ii««i3a^a i 2 

Sr^LT, roy s'-fe-v'S-SmL.fciBfl/Ty^- 
v-gyfelfSnii, AP|gfiE*0 ! a2 (El 2 2 
2#ffi) tLT, fM Ufcff&^k^tVfcChallenge Text 
Wfifi£\ |DB#(cS'(f L-fc Initialization Vectort?'* 
^PoTl/^S Shared Secret Data&rSiC-ra— K 
so ^g^ri: mfiEWTEtOChallenge TextOfit?rJ:|:g? ^rtb^ 
ID— -efctbrt, APBIE^SS (El 2 <£>#-§- 2 3#fl8) 
W^JWSrHtri-So wO#HBSr^L^©^Bl4fc*-f-7 
□ — ro^-f- j/7°S 3 0~^ry7'S 3 3©MST&5„ 
[00 2 7] g]4f±, ifET^-t^JK-r V hWBSE^S 

fi, T^ir^^^h^fil 8 ©BBE/T V S'ac— > a 
V^a^lWl 3tt, »BER**^#ai 6t»Lt« B 
SE^*>T*fcSr iSrii^PL (/Ty7"S3 0) . ^rtvi 

S3 2) OttlCAS, BIE#*>T?feSr 

SrWSi-S^-— !f icMLxm^y^ t°- 

S. 

[0028] ei/7 y -> 3 ^si#>i 

1 3 14, BH#* ) ^'('-7i43^-< ^79 h-fSWKiBSEA 

ii^®. i Qfrb<D*y srWs-rs^—rroBiE 

ffBr©A^»-«tSBfEfF"IA^©Ji*aSrSltjxff. BEE 
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1 2 Lt^MT 1 \Z&{n-fZ> (^7^3 3 
3) o 

[0 0 2 9] B2KIot, *BBEJC5«F^ s/-fc— S?2* 
$«Lfc8*»MTltt, fF*ITfcSri: 

[0030] r^t^^y hgti stc^ 

yi/x-i/gyM (H2©tt2 4#fig) ilt, T 
yyx-y 3 yg*y ^t-^^SS ID (Service 
Set Identifier) tCT x ^ft^M T 1 SrJftgiJ U f£>ik 

ftbnfcry^^— ^fpni/^— wy 

l/sTVi/x-yg yffpl^lf:7yyx-y 3 yj£ 
^y s/ir— i'Sri^fSi'io y/&^y 

^t-^wiUMT i ^sm-mtf, »iMT 1 1 

[0 0 3 1 ] fcfc, S1HMT14S, BBE#«#fc:*5^ 

[0 0 3 2] 0 3fi. BtEffiS/^-YAT* hifr&coB 

IWdJHMT 1*, «RfiA^©»f^fc«t9, Shared 
Key Authentication;^*:: «t 5^!E#jgc# S:BH*&i'5 

8Kiissflrr5. 

[0 0 3 3] 7*-fc;*#>r > hSBl 8fc*5V^T. Milfe 

BfiE/T y > a yj^Sfg 1 3 ft, A PBSE40-S 
1 (H3©#*2 5#RB) i: r ©BIE#«c#^S 

ffit^^ri^t^), Initialization Vecto 
rt Secret KeyCDfB 9 ^ — * £ U WE P (Wired E 
quivalent Privacy) PRNG (Pseudorandom Number G 
enerator) V XAICSf £frV \ 12 

8 0 c t e t CO— Scfcft^ ^Challenge Text<7)fii:$r^m 
U ::©fcfc^»fcBKJS»* j/t-yi *§*l»{9 
felfg 1 2 S:^ IT, M^MT 1 tC^fgi-So 

[0 0 3 4] #Ct£, MTBBEteS (El3(Dff2 6# 
HB) tit, aWBElS*^ «r*flrUfc»»JB 
MTlfi, ^(7)'t'^^tbaChallenge TextC0{i5r, WE 
P^Pf^lbT/Vxr y XJM;:tt£l/\ Shared Secret Data 

Initialization Vector £ y — ^ ICBfHHfc&fT 
V\ -^©{iSSrlnitialization Vector i:^{C N BtE5* 
^ o,t-^2 Ht»X7^t^ ^ y hit 1 8\Ct&{§ 
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fcB!E/T >3 >-40f3a#ai 3tt % APfgiE^ 

SI 2 (a3©#t2 7#») t UTSff 
^Challenge Texttf)fit£:, P^C^ff Lfclnitial izati 
on Vector£i^#>£Po TV ^Shared Secret Data£:Xf- 
7 3-KU ^©^i mJ^^TC^Challenge TextCOjiS 
SrJttRU TfettffAPBSE^SS (03© 

10 ^SB14fc^i"7o— <D7s*ry-fS 3 0—^7^ ^^S 3 
2, 7f^7 P S3 4^felXfc^o 
[0 0 3 5] if, rtD^JKtefe^Tttu T^ir^Tjf-Y 
yFif 18 CDB8E/T y V a ^JS^JIfi 1 3 

tt, BSES*^¥®1 6tc3*UTBBE^*>"C*)5r i 

PpBteKJ££nfcBE#^*^£;** — h$T£ v 
y°S3 1) % BfEA^#^> (^7^S32) (Dtitmiz. 
A3 Q — *\ BSEf* 3- £<E>ii*nSr£ttfcBfiE5 

20 -iftd^t LXS*f>^ tf— ^"CBSES?* IX 

[0036] ::x% WM/rvi/^^sB v^a^ili 

1 3tt, BSE#*fe»^-Y l*T^7 hi-SttfcBBEA 

JB5<OA*KJ:5BIEJE5AA©ii*i**l*ntf, MSE 

1 2^LX»B1MT UdiSW-rS (^7^/33 
4) o BJfllfc, ^IEA^#^ (^7^/S3 2) (DiKffi 
tC^^T, mmS-h? 4 hlrtltis BSE 
30 JgSSr^LfcBSE^y y-fe— i?2 Sr*fitfta«tea*a 
1 2 Sr^ Lt^ftlMT 1 l^fS Ur^^SS 
4) o 

[0 0 3 7] EI 3 CIoX, ^iSliEiS^y ^ir-^2 5: 
Sflt^ftlMTlft t^W^fc^^t^ 

tt\ ^-1ffc»L-CBSE* 5 *BScLfcri:Srii*Pi"5 (0 
3 <&#-!§• 2 9 #RH) o ±oX, rcO^fi, WMT 

[0038] ::xfStxi/^, wepot^ 

40 zfJ/XAfi, RSA Data Securitylnc. CO R C 4 fiEflflC 

«t9«SSixT*5, ifc, 7yyx-y 3 yj[ii m 
2<^Sf2 4#ffi) t>> IEEE8 0 2. HXfiSJ 
^7yyx-y 3 y^JlWfclH— Xfe5: i: i:i~5o 
[00 3 9] r C-C^BBE#*>^-f 

^ N BBES***#»fcJ:0, BSE#*>co^ib^^^ 
+ 5- tSrBiaUT^b, «t^SrW5r+«fc»fc, BSE 

b&nztiz&^tmk ux, ^7h7-^^fif^ 
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* NOTICES * 

JPO and NCIPI are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] In the access point equipment which is equipped with an interface function with the network 
built on a cable-transmission way, and makes data link connection with two or more mobile stations in 
wireless LAN area When the mobile station in said area tends to perform an authentication procedure 
before starting an association procedure, in order to obtain final authorization of an authentication 
procedure to the network administrator who manages said LAN Access point equipment characterized 
by having an input means by which authorization of the authentication over the mobile station which is 
searching for said authentication by notice means to notify that the mobile station which is searching for 
authentication is, and said network administrator who received said notice, or directions of refusal is 
inputted. 

[Claim 2] In the authentication art of access point equipment which is equipped with an interface 
function with the network built on a cable-transmission way, and makes data link connection with two 
or more mobile stations in wireless LAN area From said mobile station in the 1st step to which said 
mobile station and said access point equipment start a predetermined authentication procedure by the 
authentication demand of said access point equipment HE, and said authentication procedure When said 
access point equipment tends to permit the authentication to said mobile station, Before answering said 
mobile station in the authentication response message which is the last message in said authentication 
procedure, while notifying final authorization of said authentication procedure to the network 
administrator who manages said LAN The 2nd step which starts the waiting timer for authentication 
which set up the maximum latency time until the last authentication is performed, Before said waiting 
timer for authentication carries out a time-out to said access point equipment, said network administrator 
by the 3rd step which directs authorization or refusal of last of authentication, and said network 
administrator If the last authentication authorization is directed before said waiting timer for 
authentication carries out a time-out The 4th step as which said access point equipment answers said 
mobile station considering said authentication response message as authentication authorization, The 
authentication art of the access point equipment characterized by completing authentication of said 
mobile station and starting an association procedure by performing the 5th step to which said mobile 
station which received said authentication response message starts the procedure of an association. 
[Claim 3] The authentication art of the access point equipment according to claim 2 characterized by 
answering said mobile station considering said authentication response message as authentication refusal 
when said network administrator directs the directions which refuse authentication to said access point 
equipment at said 3rd step. 

[Claim 4] The authentication art of the access point equipment according to claim 2 which will be 
characterized by answering said mobile station considering said authentication response message as 
authentication refusal if said waiting timer for authentication carries out a time-out before said network 
administrator directs the directions with which authentication is refused or permitted to said access point 
equipment at said 3rd step. 

[Claim 5] Said authentication procedure is the authentication art of the access point equipment according 
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to claim 2 to 4 characterized by being the Shared Key Authentication procedure which IEEE802.1 1 
specifies. 

[Translation done.] 
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* NOTICES * 

JPO and NCIPI are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention] This invention relates to the access point equipment and its authentication art for 
preventing unjust access from the mobile station of the invader who had malice in the detail in the 
wireless LAN system using wireless about access point equipment and its authentication art. 
[0002] 

[Description of the Prior Art] In recent years, the cases where LAN (Local Area Network) is built at 
office, a home, etc. have been increasing in number with the explosive spread of the Internet. The 
advance of digital radio communication technology is also helped, from the troublesomeness of cable 
wiring, the needs of the so-called wireless LAN which build LAN by wireless are also increasing very 
much, further, it helps for the use under the migration environment in the migration terminal represented 
by the notebook sized personal computer to be also possible, and most number of number of spread is 
expected in the future. As a typical technique of this wireless LAN, there is already IEEE802.1 1 
standardized in IEEE (Institute of Electrical andElectronics Engineers). This standardized technique has 
specified from the physical layer to the MAC (Media Access Control: media access control) layer in an 
OSI model which is a low order sublayer of a data link, can replace it with Ethernet which is the LAN 
transmission line of a cable, and further, although it is wireless, it is the specification which can also 
offer a roaming (roaming) function as an addition function of a reason. 

[0003] Now, when building LAN with Ethernet of a cable etc., in order that connecting with LAN may 
connect a cable to a hub etc. physically, the security level of data link level is very high. That is, even if 
an invader trespasses upon office etc. unjustly and regards a terminal etc. as it connecting with a 
network, the physical activity of cable splicing is required, and it is very difficult [ it ] to perform it 
secretly, considering the arrangement situation (especially comparatively LAN of a minor scale) of 
general LAN. It is because the case where a hub, a router, etc. which constitute the LAN with the user of 
the LAN exist in the same sitting-room is most. On the other hand, in the case of a wireless LAN 
system, the activity of cable splicing, such as the above and Ethernet, replaces with an automatic 
association (Association) procedure. In systems, such as the above and existing IEEE802.1 1, this 
association procedure is a procedure for having one's existence recognized to the access point where the 
migration terminal is connected to backbone networks, such as a cable, and if this procedure is 
completed, data communication can be performed. In this procedure, the migration terminal which is 
present in the finite area which an access point (access point) covers will secure the security of data link 
level by carrying out authentication procedure of an option, before performing an association to said 
access point. 

[0004] According to this association procedure, said mobile station When an association demand is 
given to said access point, The access point which was made to contain SSID (Service Set Indentifier) in 
the association demand message, and received this In said SSID, identify said mobile station, determine 
whether permit the association according to the association authorization Ruhr decided beforehand, and 
when granting a permission When refusing the reply message of association authorization, the reply 
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message of association refusal is transmitted to said mobile station. Therefore, only in this association 
procedure, if those who are going to have malice and are going to trespass upon a network receive even 
this SSID, an association will become possible simply. In order to avoid it and to perform this 
association procedure, the option which performs authentication procedure is formed. That is, if said 
migration terminal does not complete this authentication procedure, since an association cannot do it 
according to the method which forms the option which performs authentication procedure, data 
communication cannot be started but this will offer the effective function which prevents the unjust 
association from the migration terminal with the malice in said finite area which does not need physical 
connection. 

[0005] In IEEE802.1 1, this authentication procedure is defined as a Shared Key Authentication 
procedure, and explains this procedure by drawing 5 and drawing 6 . Drawing in which drawing 5 shows 
the outline configuration of the conventional wireless LAN system, and drawing 6 are drawings showing 
the control sequence of the conventional authentication procedure and an association procedure. 
[0006] drawing 5 — setting « 1 — for a mobile station 1 and MT 4, a mobile station 2 and MT 5 is [ a 
wireless area network and 2 / an access point AP and 3 / the mobile stations 4 and MT 7 of a mobile 
station 3 and MT 6 ] the other networks outside the wireless area network 1. 
[0007] The access point AP 2 which is realized by a certain cable-transmission way and which was 
connected to the other networks 7 In the wireless area network 1 which the access point AP 2 covers, 
which exists in limited area and which consists of mobile stations MT1, MT2, MT3, and MT4 A 
sequence in case a certain mobile station (for example, MT1) carries out authentication procedure before 
an association to said access point AP 2 by actuation of switching on a power source is shown in 
drawing 6 . 

[0008] First, a mobile station MT 1 transmits the authentication demand message 1 for starting the 
authentication procedure by the Shared Key Authentication approach to an access point AP 2. AP2 
which received this message as AP authentication processing 8 (AP authentication processing "1") The 
value of Initialization Vector and Secret Key which can be decided at every authentication procedure of 
this at arbitration Consider as a parameter and math processing is performed according to the algorithm 
of WEP(Wired Equivalent Privacy) PRNG (Pseudorandom Number Generator). The value of Challenge 
Text it is decided that will be the meaning of 1280ctet(s) is computed, and the authentication response 
message 1 including this value is transmitted to a mobile station MT 1. 

[0009] Next, as MT authentication processing 9 (AP authentication processing "2"), the mobile station 
MT 1 which received this authentication response message 1 enciphers Initialization Vector in a 
parameter with Shared Secret Data in the value of said Challenge Text contained the inside according to 
the encryption algorithm of WEP, includes the value in the authentication demand message 2 with said 
Initialization Vector, and answers said access point AP 2. 

[0010] Furthermore, the access point AP 2 which received this authentication demand message 2 as AP 
authentication processing 10 (AP authentication processing "2") Initialization Vector which received the 
value of enciphered Challenge Text which received to coincidence, Decode based on said Shared Secret 
Data known beforehand, compare the result with the value of Challenge Text of the origin of the above- 
mentioned, and if it is the same It considers as authentication authorization, and if not the same, it will 
consider as authentication refusal and a mobile station MT 1 will be answered by making the result into 
the authentication response message 2. Then, if the result is authorization, the mobile station MT 1 
which received this authentication response message 2 can go into the procedure of the next association, 
when it is refusal, it is authentication failure, and cannot perform association procedure. 
[001 1] When the access point AP 2 which received SSID (Service Set Identifier) in the association 
demand message from a mobile station MT 1 identifies a mobile station in said SSID, and determines 
whether permit the association according to the association authorization Ruhr decided beforehand, it 
grants a permission as above-mentioned and association processing here refuses the association response 
message of association authorization, it transmits the association response message of association refusal 
to a mobile station MT 1 . In addition, the algorithm here of WEP is prescribed by RC4 technique of 
RSA Data Security Inc. 
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[0012] that is, — according to this authentication approach - an access point and a mobile station — oh, 
the structure which an access point permits the authentication/association to a specific mobile station is 
realized by sharing eye ** and each other's Shared Secret Key which is secret Key. Here, a certain 
amount of security level is secured, without being monitored, since it is made the mounting gestalt 
which cannot read Book Shared Secret Key in a general user, a mobile station side prevents the theft 
(reading) from an invader with malice and this Key itself does not go a radio-transmission way back and 
forth. 
[0013] 

[Problem(s) to be Solved by the Invention] However, if it is in the authentication art of such 
conventional access point equipment, it is reservation of the security in the premise of not being unjustly 
stolen by those by whom the algorithm for authentication and Key for that authentication tend to have 
malice, and tend to trespass upon a network, and this premise cannot be collateralized 100%. That is, it 
is that Key stored in the memory in which no guarantee that the entire copy of the terminal which can be 
attested to an access point is not made is and, which cannot be accessed from the user by the formal 
procedure uses a special device, and cannot declare that it must have been read unjustly. Therefore, if 
those who are going to have malice and are going to trespass upon a network by these unjust actions are 
the area which an access point covers without a physical activity like the cable splicing of a cable if the 
association of a certain terminal can be carried out unjustly, physically, they can hide and can trespass 
upon a network. That is, there was a problem which is in the dead angle separated by the exterior of the 
closed section, i.e., a wall etc., if it is in the area which the access point which exists at the core covers 
by the case where a wireless network is built that the association from the terminal of those who are 
going to trespass upon a network with malice might be allowed, in a certain closed space ( office and 
home). 

[0014] This invention is made in view of such a technical problem, and offers the access point 
equipment which can raise security level by leaps and bounds, and its authentication art in a wireless 
LAN system. 
[0015] 

[Means for Solving the Problem] In the access point equipment which the access point equipment of this 
invention is equipped with an interface function with the network built on a cable-transmission way, and 
makes data link connection with two or more mobile stations in wireless LAN area When the mobile 
station in said area tends to perform an authentication procedure before starting an association 
procedure, in order to obtain final authorization of an authentication procedure to the network 
administrator who manages said LAN It is characterized by having an input means by which 
authorization of the authentication over the mobile station which is searching for said authentication by 
notice means to notify that the mobile station which is searching for authentication is, and said network 
administrator who received said notice, or directions of refusal is inputted. 

[0016] The authentication art of the access point equipment of this invention In the authentication art of 
access point equipment which is equipped with an interface function with the network built on a cable- 
transmission way, and makes data link connection with two or more mobile stations in wireless LAN 
area From said mobile station in the 1st step to which said mobile station and said access point 
equipment start a predetermined authentication procedure by the authentication demand of said access 
point equipment HE, and said authentication procedure When said access point equipment tends to 
permit the authentication to said mobile station, Before answering said mobile station in the 
authentication response message which is the last message in said authentication procedure, while 
notifying final authorization of said authentication procedure to the network administrator who manages 
said LAN The 2nd step which starts the waiting timer for authentication which set up the maximum 
latency time until the last authentication is performed, Before said waiting timer for authentication 
carries out a time-out to said access point equipment, said network administrator by the 3rd step which 
directs authorization or refusal of last of authentication, and said network administrator If the last 
authentication authorization is directed before said waiting timer for authentication carries out a time-out 
The 4th step as which said access point equipment answers said mobile station considering said 
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authentication response message as authentication authorization, By performing the 5th step to which 
said mobile station which received said authentication response message starts the procedure of an 
association, authentication of said mobile station is completed and it is characterized by starting an 
association procedure. 

[0017] Moreover, at said 3rd step, when said network administrator directs the directions which refuse 
authentication to said access point equipment, said mobile station may be answered considering the 
authentication response message which is the last message in said authentication procedure as 
authentication refUsal. 

[0018] Moreover, at said 3rd step, if said waiting timer for authentication carries out a time-out before 
said network administrator directs the directions with which authentication is refused or permitted to 
said access point equipment, said mobile station may be answered considering the authentication 
response message which is the last message in said authentication procedure as authentication refusal 
Moreover, as a desirable concrete mode, said authentication procedure may be a Shared Key 
Authentication procedure which IEEE802.1 1 specifies. 
[0019] 

[Embodiment of the Invention] Hereafter, the gestalt of operation of the suitable access point equipment 
of this invention and its authentication art is explained to a detail, referring to an accompanying drawing. 
Drawing 1 is drawing showing the outline configuration of the access point equipment of the gestalt of 
operation of this invention. 

[0020] The access point equipment 18 of the gestalt of this operation is replaced and installed in the 
access point AP 2 of said drawing 5 . That is, in said drawing 5 , in the access point AP 2 which is 
realized by a certain cable-transmission way and which was connected to the other networks 7, and the 
wireless area network 1 which the AP2 covers and which consists of mobile stations MT1, MT2, MT3, 
and MT4 which exist in limited area, said access point AP 2 is transposed to the access point equipment 
18 shown in drawing 1 , and is constituted. 

[0021] In drawing 1 access point equipment 18 In order to make wireless connection with two or more 
mobile stations MT1, MT2, MT3, and MT4 The radio processing means 12 which consists of the 
wireless strange recovery section, the baseband signaling processing section, and the data-link-control 
section, The antenna 19 for wireless transmission and reception connected to the radio processing means 
12, A network interface means 14 to realize the function which interfaces the data which make data link 
connection by the other networks 7 and the cable-transmission way 17 of arbitration, and are transmitted 
and received by the radio processing means 12, The radio processing means 12 performs the association 
procedure and authentication procedure for performing data link establishment with two or more mobile 
stations. There Needed authentication / association processing means 13 to realize the function to 
exchange with the radio processing means 12 the control message exchanged for mobile stations MT1, 
MT2, MT3, and MT4, When authentication / association processing means 13 performs authentication 
processing, before permitting it finally and transmitting the message of authentication authorization to 
the mobile station which should carry out authentication authorization, by notifying it An authentication 
demand display means 16 (notice means) to realize the function which notifies the user who manages 
the wireless area network 1 of the existence of a mobile station which is carrying out the authentication 
demand by the display device, the loudspeaker, etc., After the existence of a mobile station which is 
carrying out the authentication demand with the authentication demand display means 16 is notified In 
order that the user who manages the wireless area network 1 may notify permitting or refusing it to 
authentication / association processing means 13, it consists of authentication input means 15 (input 
means) to realize the function to receive the physical input of human beings, such as a carbon button. 
[0022] Hereafter, actuation of the authentication art of the access point equipment constituted as 
mentioned above is explained. Here, authentication procedure and association procedure are performed 
for a certain mobile station by powering on f s etc. actuation, and a sequence in case the case where the 
data link connection with access point equipment 18 is established, and authentication are refused is 
explained. 

[0023] The mobile station MT 1 in said drawing 5 should be used as the mobile station of the object 
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which performs authentication processing, mobile stations MT2, MT3, and MT4 should already be 
completed to access point equipment 18 and an association, and the data link shall be established. First, 
the user to whom a mobile station MT 1 manages a network in authentication procedure permits the 
authentication, and association procedure explains after that the case where a data link with access point 
equipment 18 is established, with reference to drawing 2 and drawing 4 . 
[0024] Drawing 2 is drawing showing the control sequence of the authentication procedure in 
authentication authorization. A mobile station MT 1 transmits the authentication demand message 1 for 
starting the authentication procedure by the Shared Key Authentication approach to access point 
equipment 18 first by powering on f s etc. actuation. 

[0025] In access point equipment 18, authentication / an association processing means 13 by which this 
message was received, through the radio processing means 12 As AP authentication processing 1 
(number 20 reference of drawing 2 ), at every authentication procedure of this The value of Initialization 
Vector and Secret Key which can be decided to be arbitration is made into a parameter. Math processing 
is performed according to the algorithm of WEP(WiredEquivalent Privacy) PRNG (Pseudorandom 
Number Generator). The value of Challenge Text it is decided that will be the meaning of 1280ctet(s) is 
computed, and the authentication response message 1 including this value is transmitted to a mobile 
station MT 1 through the radio processing means 12. 

[0026] Next, as MT authentication processing 21, the mobile station MT 1 which received this 
authentication response message 1 enciphers the value of Challenge Text contained in it by making 
Shared Secret Data and Initialization Vector into a parameter according to the encryption algorithm of 
WEP, includes the value in the authentication demand message 2 with Initialization Vector, and answers 
access point equipment 18. In access point equipment 18, furthermore, authentication / an association 
processing means 13 by which this message was received, through the radio processing means 12 As AP 
authentication processing 2 (number 22 reference of drawing 2 ), the value of enciphered Challenge Text 
which received It decodes based on Initialization Vector which received to coincidence, and Shared 
Secret Data known beforehand. The result is compared with the value of above-mentioned original 
Challenge Text, and if it is the same, the procedure of AP authentication processing 3 (number 23 
reference of drawing 2 ) will be performed. Processing of step S30 of the flow shown in drawing 4 - step 
S3 3 showed this procedure. 

[0027] Drawing 4 is a flow chart which shows authentication processing of the above-mentioned access 
point, first, in this procedure, to the authentication demand display means 16, authentication / 
association procedure 13 of access point equipment 18 notify that it is the waiting for authentication 
(step S30), starts it, simultaneously the waiting timer for authentication set as the time amount of 
arbitration (step S31), and goes into the condition of the waiting for an authentication input (step S32). 
An authentication demand display means 16 by which the notice of being the waiting for authentication 
was received on the other hand notifies that the mobile station which is carrying out the authentication 
demand by the display device, the loudspeaker, etc. immediately to the user who manages a network 
exists. 

[0028] Here, if the notice of the authentication authorization input by the input of the user who manages 
the network from the authentication input means 16 of authentication authorization is received before 
the waiting timer for authentication carries out the time-out of authentication / the association procedure 
13, the authentication response message 2 which showed authentication authorization will be transmitted 
to a mobile station MT 1 through the radio processing means 12 (step S33). 
[0029] It returns to drawing 2 , and since the result is authorization, the mobile station MT 1 which 
received this authentication response message 2 goes into the procedure of the next association, and 
transmits an association demand message to access point equipment 18. 

[0030] It sets to access point equipment 18 here. Authentication / an association processing means 13 by 
which this message was received, through the radio processing means 12 As association processing 
(number 24 reference of drawing 2 ), in SSID in an association demand message (Service Set Identifier) 
When identifying a mobile station MT 1, determining whether permit the association according to the 
association authorization Ruhr decided beforehand and permitting it The association response message 
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which showed association authorization to the mobile station MT 1 through the radio processing means 
12 is transmitted. If a mobile station MT 1 receives this association response message, a data link will be 
established between a mobile station MT 1 and access point equipment 18, and the communication link 
of data will be attained henceforth. 

[0031] Next, when a mobile station MT 1 has the authentication refused by the user who manages a 
network in authentication procedure, the waiting timer for authentication carries out a time-out, and the 
case where authentication is refused is automatically explained with reference to drawing 3 and drawing 
4. 

[0032] Drawing 3 is drawing showing the control sequence of the authentication procedure of 
authentication refusal / time-out case. In drawing 3 , a mobile station MT 1 transmits the authentication 
demand message 1 for starting the authentication procedure by the Shared Key Authentication approach 
to access point equipment 18 by powering on's etc. actuation. 

[0033] In access point equipment 18, authentication / an association processing means 13 by which this 
message was received, through the radio processing means 12 As AP authentication processing 1 
(number 25 reference of drawing 3 ), at every authentication procedure of this The value of Initialization 
Vector and Secret Key which can be decided to be arbitration is made into a parameter. Math processing 
is performed according to the algorithm of WEP(Wired Equivalent Privacy) PRNG (Pseudorandom 
Number Generator). The value of Challenge Text it is decided that will be the meaning of 1280ctet(s) is 
computed, and the authentication response message 1 including this value is transmitted to a mobile 
station MT 1 through the radio processing means 12. 

[0034] Next, as MT authentication processing (number 26 reference of drawing 3 ), the mobile station 
MT 1 which received this authentication response message 1 enciphers Initialization Vector as Shared 
Secret Data in a parameter in the value of Challenge Text contained the inside according to the 
encryption algorithm of WEP, includes the value in the authentication demand message 2 with 
Initialization Vector, and answers access point equipment 18. In access point equipment 18, 
furthermore, authentication / an association processing means 13 by which this message was received, 
through the radio processing means 12 The value of enciphered Challenge Text which received as AP 
authentication processing 2 (number 27 reference of drawing 3 ) It decodes based on Initialization 
Vector which received to coincidence, and Shared Secret Data known beforehand. The result is 
compared with the value of above-mentioned original Challenge Text, and if it is the same, the 
procedure of AP authentication processing 3 (number 28 reference of drawing 3 ) will be performed. 
Processing of step S30 of the flow shown in drawing 4 - step S32, and step S34 showed this procedure. 
[0035] first, in this procedure, authentication / association procedure 13 of access point equipment 18 
notify that it is the waiting for authentication to the authentication demand display means 16 (step S30), 
starts it, simultaneously the waiting timer for authentication set as the time amount of arbitration (step 

531) , and goes into the condition of the waiting for an authentication input (step S32). An authentication 
demand display means 16 by which the notice of being the waiting for authentication was received on 
the other hand notifies that the mobile station which is carrying out the authentication demand by the 
display device, the loudspeaker, etc. immediately to the user who manages a network exists. 

[0036] Here, if the notice of the authentication refusal input by the input of the user who manages the 
network from the authentication input means 16 of authentication refusal is received before the waiting 
timer for authentication carries out the time-out of authentication / the association procedure 13, the 
authentication response message 2 which showed authentication refusal will be transmitted to a mobile 
station MT 1 through the radio processing means 12 (step S34). Similarly, if the waiting timer for 
authentication carries out a time-out in the condition of the waiting for an authentication input (step 

532) , the authentication response message 2 which showed authentication refusal will be transmitted to 
a mobile station MT 1 through the radio processing means 12 (step S34). 

[0037] If it returns to drawing 3 , the mobile station MT 1 which received this authentication response 
message 2 is not put into the procedure of the next association since the result is refusal, but there is 
need, what authentication went wrong to the user will be notified (number 29 reference of drawing 3 R> 
3). Therefore, a mobile station MT 1 cannot perform data communication in this case. 
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[0038] In addition, the algorithm of WEP which has made reference here is made the same as that of the 
association procedure in which it is prescribed by RC4 technique of RSA Data Securitylnc., and 
association processing (number 24 reference of drawing 2 R> 2) is also specified by IEEE802.1 1. 
[0039] Moreover, after the user who manages a network recognizes it that the mobile station of the 
waiting for authentication exists to be the time amount of the arbitration set as the waiting timer for 
authentication here with an authentication demand display means, in order to permit it, the user who 
manages a network considers as what can be set as arbitration as an appropriate value which will be 
converted from required time amount by the authentication input means by the time it inputs 
authorization. 

[0040] As stated above, with the gestalt of this operation access point equipment 18 When the mobile 
station in area performs an authentication procedure before starting an association procedure, in order 
that access point equipment 18 may obtain final authorization of an authentication procedure to the 
network administrator who manages LAN An authentication demand display means 16 to notify that the 
mobile station which is searching for authentication is in area, To eye backlash which it has an 
authentication input means 15 by which the network administrator who received the notice directs 
authorization or refusal of authentication to the mobile station which is searching for authentication, and 
cannot be viewed physically In the wireless LAN system with malice which is easy to receive an attack 
of the invader of network WAKUHE in the authentication procedure before the association of a mobile 
station It does not perform automatically that an access point permits it, but after who views whether it 
is going to carry out the association, since the user who manages the network can give the authorization, 
he can raise security level by leaps and bounds. 

[0041] Moreover, the procedure of this authentication is IEEE802.1 1, in the wireless LAN system which 
is specified as an option and which mounts the Shared Key Authentication procedure, additional 
mounting is required only about access point equipment, and, as for mobile station equipment, it is 
possible to make it function, without changing in any way. 
[0042] 

[Effect of the Invention] As mentioned above, according to this invention, as explained in full detail, in 
a wireless LAN system, security level can be raised by leaps and bounds, and mobile station equipment 
can be carried out, without changing in any way. 



[Translation done.] 
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